{"id":"CVE-2026-93017","aliases":[],"cve":{"records":[{"id":"CVE-2026-93017","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T14:51:36.301Z","published":"2026-10-08T14:31:58.671Z","modified":"2026-11-13T13:14:34.913Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-13T13:14:34.913Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-10T03:09:27.425Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:82785","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:82813","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:83480","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:83502","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:83702","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:89198","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:89715","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:89726","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:90274","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95746","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:96283","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93017","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515741","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-269","description":"Improper Privilege Management","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-10T03:09:17.420970Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader","titleSource":"redhat","descriptionSource":"redhat","description":"The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n  - \"\"\n  resources:\n  - secrets\n  verbs:\n  - get\n  - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```","score":7.7,"severity":"high","published":"2026-10-08T14:31:58.671Z","modified":"2026-11-13T13:14:34.913Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.12","platforms":[],"versions":[{"version":"1792974936","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.13","platforms":[],"versions":[{"version":"1793825599","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.14","platforms":[],"versions":[{"version":"1791842870","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.15","platforms":[],"versions":[{"version":"1791632611","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.16","platforms":[],"versions":[{"version":"1792879727","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.17","platforms":[],"versions":[{"version":"1793904247","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.18","platforms":[],"versions":[{"version":"1792874579","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.19","platforms":[],"versions":[{"version":"1791626249","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.20","platforms":[],"versions":[{"version":"1791625576","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.21","platforms":[],"versions":[{"version":"1791980436","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 4.22","platforms":[],"versions":[{"version":"1792771251","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"},{"vendor":"Red Hat","name":"Red Hat OpenShift Container Platform 5","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:openshift:5"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"}],"references":["https://access.redhat.com/errata/RHSA-2026:82785","https://access.redhat.com/errata/RHSA-2026:82813","https://access.redhat.com/errata/RHSA-2026:83480","https://access.redhat.com/errata/RHSA-2026:83502","https://access.redhat.com/errata/RHSA-2026:83702","https://access.redhat.com/errata/RHSA-2026:89198","https://access.redhat.com/errata/RHSA-2026:89715","https://access.redhat.com/errata/RHSA-2026:89726","https://access.redhat.com/errata/RHSA-2026:90274","https://access.redhat.com/errata/RHSA-2026:95746","https://access.redhat.com/errata/RHSA-2026:96283","https://access.redhat.com/security/cve/CVE-2026-93017","https://bugzilla.redhat.com/show_bug.cgi?id=2515741"],"sources":[{"name":"CVE","id":"CVE-2026-93017","modified":"2026-11-13T13:14:34.913Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","score":7.7}],"sourceAffected":[],"observedAt":"2026-11-13T18:03:00.106Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:10:33.488Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T17:35:34.592Z","attemptedAt":"2026-10-29T17:35:34.592Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T17:35:34.753Z","attemptedAt":"2026-10-29T17:35:34.753Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T17:35:35.417Z","attemptedAt":"2026-10-29T17:35:35.417Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T17:35:34.304Z","attemptedAt":"2026-10-29T17:35:34.304Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-93017","url":"https://www.first.org/epss/","probability":0.00374,"percentile":0.31282,"date":"2026-10-29","checkedAt":"2026-10-29T17:35:34.304Z"},{"source":"NVD","id":"CVE-2026-93017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93017","modified":"2026-10-29T17:18:11.883","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-29T17:35:34.592Z"},{"source":"GitHub Advisory Database","id":"GHSA-97xr-6xrj-3f39","url":"https://github.com/advisories/GHSA-97xr-6xrj-3f39","modified":"2026-10-23T06:32:31Z","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-29T17:35:34.753Z"},{"source":"ENISA EUVD","id":"EUVD-2026-95030","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95030","modified":"Oct 23, 2026, 5:09:29 AM","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","checkedAt":"2026-10-29T17:35:35.417Z"}],"aiSummary":{"text":"Red Hat OpenShift Container Platform's insights-operator gather service account has cluster-wide secret read access, allowing an attacker with pod spawning capabilities to access any secret in any namespace. The affected product versions are not explicitly stated as vulnerable or unaffected. The weakness is due to improper privilege management.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-14T03:16:04.285Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93017"}]}}